827a

Passkeys are so, so, so bad. One of the worst things our industry invented. The sooner sites start leaving them on the wayside and just go back to TOTP, SMS, and Email codes/links, the better. These work. We solved auth. Its fine.

They should definitely fix it, but that's mostly because its an "unnecessary autoplay" so to speak. There's plenty of "necessary autoplays" out there, and AI is going to add more and more every day, because that's where productivity comes from. But, why Cursor would ever need to execute the git binary in your project directory is beyond me; very clearly a bug.

Their ignorance of the bug report is also very clear and concerning negligence.

But I think simultaneously, the security team is making a mountain out of a molehill. This is a classic thing security teams love doing; everything is military defcon P0. So, its important to check them regularly, and remind them that the most secure system is no system; they are but one part of a greater ecosystem.

Frankly, if you git clone a compromised repository, I'm not sure that a vulnerability of the class "compromised code in that repository will be executed" is all that major a concern. There are plenty of IDEs that will go autonomously run npm installs (with post-install scripts) for you when they detect a package.json. This isn't all that different than that.

They could throw up a warning like "do you trust this repository" oh wait they already do, and no one cares. Security is hard. Ultimately if you have compromised code on your machine, all bets are off.

The constitution does not really care about scale, though, and that’s my point. It’s a reason why the legislature should care about Flock, but not why the judicial should.

The constitution does not really care about scale, though, and that’s my point. It’s a reason why the legislature should care about Flock, but not why the judicial should.

The argument I struggle to get around and would love to hear a counter-argument to: Let's say a local police department hired 175 police officers, each being told "Go stand on this particular intersection with a pad of paper and write down every license plate you see". This would be a stupid use of resources, but is not outside the realm of something a well-funded police department could do. Every night they take their reports back to HQ, and file them away.

This is a modestly different situation than one concerning warrantless tracking of phone locations, if for no other reason than my phone oftentimes in my pocket. It is not always visible to onlooking bystanders. And even if it isn't, externally there is no reliably way to differentiate one iPhone from another. In comparison: license plates, when in public, are always visible, and very easy to discern from one-another (different state-unique numbers); so in my mind the expectation of privacy is far lower.

I abhor what Flock does, but I'm not sure I see a constitutional argument for why what they do is unconstitutional.

Microcenter has them marked at $4500 right now (that's with the 4TB SSD) [1]. I suspect it comes down to what you're using it for; if you're looking for a general purpose computer that's also solid at AI, the AMD machine is better. But if you want the best possible AI machine at below $5k... actually you should probably just buy an RTX 3090 or 5090. But if the 128gb of memory is critical, then yeah DGX Spark is it.

[1] https://www.microcenter.com/product/699008/nvidia-dgx-spark

Framework, weirdly, overcharges considerably for their SSDs. You can currently get a Samsung 990 Pro 2TB on Amazon for $390; Framework charges $625 for the Sandisk 850x 2TB, which has similar performance (and is being sold on Amazon for $530).

If you DIY your own SSD, you can spec a Framework Desktop for below $4k; but not much below. Roughly the same price.

Tbh we'll see what using it looks like, but the reasoning/cost charts do not look promising. It seems like the only useful reasoning level for Sonnet 5 is Low; medium might trade blows at price/performance with Opus, but anything beyond that Opus is Just Better.

I struggle to understand where this model fits in. If I need a cheap model for simple stuff (like, summarizing an email); I'd go Haiku (actually, I'd go Deepseek v4 Flash, but you catch my drift). I just can't think of many tasks where I'm like "yeah let me reach for Sonnet Low Reasoning so I can save a dollar but also seriously run the risk of it failing"; I'd just reach for Opus Low.

Why are you comparing xhigh reasoning between Sonnet and Opus? Of course Sonnet xhigh is cheaper than Opus xhigh, but that isn't the point; the point is that at e.g. 80% accuracy on Opus costs ~$0.45 (medium reasoning) whereas on Sonnet it costs ~$0.52 (xhigh/max reasoning).

This seems really, really stupid. Similar to the weird Zig runtime signature thing from a few months ago ago, it was bound to be discovered, quickly, and all the resellers have to do is find a new domain name that (checks notes) doesn't have the word DEEPSEEK in it. Like, seriously? Your goal was to identify resellers by checking if the proxy has the corporate name of one of your competitors in it? Is this amateur hour?

All Anthropic has done is reduce trust, once again, with legitimate customers, while doing nothing to stop illegitimate customers. They need to get adults into key leadership roles, quickly.

Apple does not sell a 64GB variant of the M4 Mac Mini. IIRC they never have; its always capped out at 48GB.

If you were planning on getting an M5 128GB; just get a DGX Spark (~$4500) or a 5090-equipped machine (~$4500) plus a Macbook Air (~$1500). You'll come in below the M5 Max 128 pricing (~$6700+ USD) and be happier for it.

Yeah I just mean that if a business came to them and asked for fifty licenses to the $200/mo plan, OpenAI would tell them to kick dirt and basically pay API pricing. Startups should 100% just be telling their employees they can expense up-to $whatever/mo in AI-related expenses, and let software engineers go buy personal Codex/Claude subscriptions.

Company-wide their margins are trash (probably negative). They need as much inference margin as they can get to afford the massive training runs. It is likely that we'll see GPT-5.6 reduce API pricing to compete against Anthropic, but whether Anthropic feels they need to reduce their prices is anyone's guess.

IMO: If the project leverages Google branding or authority improperly, then it shouldn't be on github and should not be under active development by Google employees; yet it is. If Google is suddenly alright with the way the project leveraged Google branding and authority, then the cause for firing the original developer, especially given Google's famously lax stance toward 20% projects and internal open source, is a lot weaker. In other words: Healthy companies do not fire individuals simply for breaching branding guidelines in a way that is ultimately beneficial and looked favorably upon by the company. That's literally just not a thing that happens; at worst you get a reprimand, and in many healthy companies you'd actually get a promotion.

So, something does not add up. It might be the story of the person fired. It might also be on the other side; that our external impression on what's been going on inside of Google needs to be re-adjusted, and this company will be a lot weaker in ten years than I would have originally estimated.

Zitron's numbers don't tell us the real cost of generating tokens but, subject to the assumption that the platforms are not subsidizing the token price, that means Anthropic is subsidizing their enterprise customers by up to 40 times, and OpenAI up to 70 times

Neither Anthropic nor OpenAI are subsidizing enterprise customers. Neither Anthropic nor OpenAI allow Business nor Enterprise customers access to the high value $200/mo plan. Both organizations have moved to a "cheaper plan per user + API Pricing after that" (e.g. $20/mo + usage). The $100/$200/mo plans are for individuals only (of course, many individuals use these plans at work, but that's beside the point; they aren't selling this plan to enterprises).

SemiAnalysis also analyzed the platform's gross margins, implausibly assuming that tokens were priced at 4 times the cost of generating them and: With the current subsidies, all it takes for a user to have a gross margin of at best negative 25% is for them to use as little as 25% of their rate limit.

The article's source for this claim is not SemiAnalysis; its Zitron. But once you dig through his article, Zitron links to a SemiAnalysis tweet [1] where they, as the paragraph states, implausibly assume gross margins of 75% to come up with their weird analysis of the subscription plans. Citing this for anything is weird, because afaik that 75% number is a total shot in the dark. We have no clue what their margins are. My take is that the only reason that 75% number is implausible is because it may underestimate the inference margins of Ant/OAI's API pricing.

[1] https://x.com/SemiAnalysis_/status/2064815045767213400?ref=w...

Intelligence is maybe a few months behind. But cost sadly is further behind. GLM-5.2 has a deceptively high cost during day-to-day usage for e.g. coding because 1) it has to think a ton more than GPT-5.5/Opus-4.8 to get to competitive results; 2) many providers are still figuring out caching; and 3) API pricing for Codex/Claude can be as high as 40x more than subscription pricing, which distorts the market.

if your server is implemented in a sensible way,

lol

Its a very well known fact that all of our geopolitical adversaries have sophisticated fake American ID markets. This doesn't stop any of the most dangerous adversaries from getting access to systems protected by this technology. DeepSeek is going to go buy 20,000 fake IDs for their fake distillation accounts and keep on keeping on. This just hurts normal people, Americans and non-Americans, who might struggle to authenticate or be disallowed because of their place of birth. Pointless CYA, and beneath a research group whose intention is to invent the machine god.

Yup exactly. This functionality might be available under their "Organizations" feature, but that is on the Enterprise plan. Almost a year ago they announced that nearly all Enterprise-plan features would be coming to everyone, so I suppose sadly that one didn't make the cut [1]?

The system I follow is creating a new account for the client using a plus-code on my email address (like john+client10@example.com), then I invite my main account (john@example.com), then I can invite clients into that account. Its a PITA.

[1] https://blog.cloudflare.com/enterprise-grade-features-for-al...

Correct me if I'm wrong, but does Cloudflare still not have a "Create Account" button on the account listing page? I think you still have to sign up from scratch doing plus-code email tricks, then invite your original email address as an admin, juggling multiple accounts. They should consider fixing that first.

As I recall there were some people on reddit who got the UNAS Pro 8 up to 10gig, but yeah it was only through some level of software tweaks or network stack config or something. From the factory my understanding is that it struggles.

It does have a dual NVMe cache; those in RAID-0 will saturate (e.g. I believe just one Samsung 990 Pro can write at just over 50Gbps).

The bigger risk is the CPU. This is an issue with the Ubiquiti UNAS Pro 8, their ~$800 USD 8 bay NAS. In theory it has 10gig networking. In practice the CPU physically cannot transfer bits fast enough, because its a dinky underpowered ARM CPU that they clearly chose to hit that quite affordable price point. Its a decent trade-off, because similar units from Synology are more like $1600, and you can meaningfully hit somewhere between 2.5gig and 10gig; but saturating 10gig is out of the question.

The ENAS has a beefier CPU so it might keep up with 25gig (could this do 50gig bonded?). But only testing will tell.

Kubernetes and the one I'm working at right now.

Possibly, but the real issue is more subtle: The people who need to hear this literally won't hear your anger. They're not reading HackerNews. They'll never see this blog post. They won't hear your screams. Your emotions will never be validated; we're in an echo chamber, and the people who most need to hear it won't hear it.

There's no indication that the original blog post author ever actually contacted Photobucket. Nor, would I believe, anyone in these comments tried to. We're just people on some small, isolated corner of the internet letting some dumb SaaS product ruin your day.

Maturity is recognizing that ninety-eight times out of a hundred, there actually is nothing you can do, because nothing you do will change it. Getting angry means you're letting these people you dislike into your head, controlling your thoughts; why would you be proud of that? In the remaining two times out of a hundred, regulating your emotions by providing them the feedback in a calm, direct manner is as effective as doing so in the manner this blog post took; sometimes it is even more effective, because people generally do not engage with others who they perceive to be acting without reason.

You'll discover this path on your own, and make mistakes along the way, as anyone has. The thing you need to hear right now is: Your comment had exactly zero impact on me. It is like you never even posted it.

This presumption has destroyed far, far more companies and projects than the opposite assumption (that something built for small will scale to big, then doesn't).

I don't necessarily mean this to be dismissive, but it'll come off like that and it is what it is: Don't go through life getting this mad at something so inconsequential (five dollars). The typical response is "its the principal", but they're not beholden to your principals, and getting worked up because someone else compromised your principals is not healthy. Its just other people doing things. Neither money nor principals will save you from the downstream effects this attitude will have on your body and soul.

You clearly have not used Cursor lately. It’s substantially more than all that. It’s not a VSCode extension anymore.

If you want to understand the impact of AI technology on the economy, don't listen to software engineers, in fact, don't listen to anyone, no one was able to predict what the economy was going to do pre-AI, no one has any clue what's going on.